VulnerabilityModified
CVE-2021-39278
Certain MOXA devices allow reflected XSS via the Config Import menu.
MEDIUM 6.1EPSS 0.94%
Does this matter?
Lower severity and a low EPSS score (0.94%). Track it; it rarely justifies an emergency change on its own.
Description
Certain MOXA devices allow reflected XSS via the Config Import menu. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.94% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- moxa/wac-2004 firmware · moxa/wac-1001 firmware · moxa/wac-1001-t firmware · moxa/oncell g3470a-lte-eu firmware · moxa/oncell g3470a-lte-eu-t firmware · moxa/tap-323-eu-ct-t firmware · moxa/tap-323-us-ct-t firmware · moxa/tap-323-jp-ct-t firmware · moxa/wdr-3124a-eu firmware · moxa/wdr-3124a-eu-t firmware · moxa/wdr-3124a-us firmware · moxa/wdr-3124a-us-t firmware
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/164014Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/164014Exploit, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.